kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/hid
History
Michael Bommarito 390d3d9c52 HID: hyperv: validate initial device info bounds 
commit 934b7778aa upstream.

The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO
messages that contain a HID descriptor followed by the report descriptor
bytes. mousevsc_on_receive_device_info() trusts bLength and
wDescriptorLength without checking that the received packet contains both
byte ranges.

A malformed host or backend message can therefore make the guest read
past the received VMBus packet while copying the report descriptor. Pass
the received initial-device-info size into the parser and reject
descriptor lengths that exceed the packet.

Impact: A malicious Hyper-V host or backend can crash a guest by sending
a short initial device-info message with an oversized HID report
descriptor length.

Fixes: b95f5bcb81 ("HID: Move the hid-hyperv driver out of staging")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5-5-xhigh
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-27 14:28:23 +02:00
..
amd-sfh-hid HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() 2024-10-17 15:11:59 +02:00
i2c-hid HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up 2024-05-02 16:24:50 +02:00
intel-ish-hid HID: intel-ish-hid: Reset enum_devices_done before enumeration 2026-02-11 13:35:29 +01:00
surface-hid HID: surface-hid: Allow driver matching for target ID 1 devices 2021-11-18 19:15:59 +01:00
usbhid HID: usbhid: fix deadlock in hid_post_reset() 2026-06-01 17:35:35 +02:00
hid-a4tech.c HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 2021-05-05 14:29:13 +02:00
hid-accutouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-alps.c HID: alps: fix NULL pointer dereference in alps_raw_event() 2026-06-01 17:35:04 +02:00
hid-apple.c HID: apple: Add 2021 magic keyboard FN key mapping 2024-02-23 08:54:55 +01:00
hid-appleir.c HID: appleir: fix UAF on pending key_up_timer in remove() 2026-07-24 15:52:00 +02:00
hid-asus.c HID: asus: do not abort probe when not necessary 2026-06-01 17:35:34 +02:00
hid-aureal.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
hid-axff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-belkin.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-betopff.c HID: betop: check shape of output reports 2023-02-01 08:27:13 +01:00
hid-bigbenff.c hid: bigben_probe(): validate report count 2023-03-10 09:39:31 +01:00
hid-cherry.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-chicony.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cmedia.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-core.c HID: core: fix number/pointer type confusion on long items 2026-08-27 14:28:23 +02:00
hid-corsair.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cougar.c HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup 2024-09-12 11:07:49 +02:00
hid-cp2112.c hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip 2023-11-20 11:08:23 +01:00
hid-creative-sb0540.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-cypress.c HID: cypress: Support Varmilo Keyboards' media hotkeys 2020-10-23 13:23:44 +02:00
hid-debug.c HID: fix HID device resource race between HID core and debugging support 2023-12-03 07:31:22 +01:00
hid-dr.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-elan.c HID: elan: Fix potential double free in elan_input_configured 2022-06-09 10:22:47 +02:00
hid-elecom.c HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
hid-elo.c HID: elo: Revert USB reference counting 2022-03-16 14:23:35 +01:00
hid-emsff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-ezkey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ft260.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-gaff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-gembird.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-gfrm.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-glorious.c HID: glorious: fix Glorious Model I HID report 2023-12-20 15:17:40 +01:00
hid-google-hammer.c HID: google: fix unused variable warning under !CONFIG_ACPI 2025-03-13 12:51:04 +01:00
hid-gt683r.c HID: gt683r: add missing MODULE_DEVICE_TABLE 2021-05-27 15:40:34 +02:00
hid-gyration.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-holtek-kbd.c HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 2023-10-25 11:59:00 +02:00
hid-holtek-mouse.c HID: holtek: fix mouse probing 2021-12-29 12:28:37 +01:00
hid-holtekff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-hyperv.c HID: hyperv: validate initial device info bounds 2026-08-27 14:28:23 +02:00
hid-icade.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ids.h HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 2026-06-01 17:35:01 +02:00
hid-input.c HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen 2026-01-19 13:09:45 +01:00
hid-ite.c HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 2022-12-14 11:37:21 +01:00
hid-jabra.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kensington.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-keytouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kye.c HID: hid-kye: Fix incorrect function name for kye_tablet_enable() 2021-04-07 18:46:20 +02:00
hid-lcpower.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-led.c HID: hid-led: fix maximum brightness for Dream Cheeky 2022-06-09 10:22:47 +02:00
hid-lenovo.c HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 2025-07-17 18:30:54 +02:00
hid-lg-g15.c HID: lg-g15: cancel pending work on remove to fix a use-after-free 2026-07-24 15:51:22 +02:00
hid-lg.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-lg.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lg2ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg3ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg4ff.c HID: hid-lg4ff: Add check for empty lbuf 2022-12-14 11:37:21 +01:00
hid-lg4ff.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lgff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-logitech-dj.c HID: logitech-dj: Fix maxfield check in DJ short report validation 2026-08-19 17:14:12 +02:00
hid-logitech-hidpp.c HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter 2026-07-24 15:51:37 +02:00
hid-macally.c HID: macally: Constify macally_id_table 2020-08-17 11:38:49 +02:00
hid-magicmouse.c HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID 2026-08-27 14:28:22 +02:00
hid-maltron.c Support for Maltron L90 keyboard media keys 2019-01-14 20:11:01 +01:00
hid-mcp2221.c HID: mcp2221: cancel last I2C command on read error 2026-04-18 10:33:23 +02:00
hid-mf.c HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter 2020-11-25 14:30:33 +01:00
hid-microsoft.c HID: microsoft: Add rumble support to latest xbox controllers 2024-09-04 13:23:36 +02:00
hid-monterey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-multitouch.c HID: multitouch: fix out-of-bounds bit access on mt_io_flags 2026-07-24 15:52:00 +02:00
hid-nti.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ntrig.c HID: hid-ntrig: Prevent memory leak in ntrig_report_version() 2025-12-07 06:09:29 +09:00
hid-ortek.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-penmount.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-petalynx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-picolcd.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_backlight.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_cir.c media: rc: harmonize infrared durations to microseconds 2020-09-03 16:18:55 +02:00
hid-picolcd_core.c HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() 2026-07-24 15:51:43 +02:00
hid-picolcd_debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_fb.c fbdev: Rename pagelist to pagereflist for deferred I/O 2024-02-23 08:55:13 +01:00
hid-picolcd_lcd.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-pl.c HID: hid-pl: handle probe errors 2026-03-04 07:20:26 -05:00
hid-plantronics.c HID: hid-plantronics: Add mic mute mapping and generalize quirks 2025-04-10 14:31:55 +02:00
hid-playstation.c HID: playstation: Add missing check for input_ff_create_memless 2026-03-04 07:19:32 -05:00
hid-primax.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-prodikeys.c HID: prodikeys: Check presence of pm->input_ep82 2026-03-04 07:20:26 -05:00
hid-quirks.c HID: quirks: really enable the intended work around for appledisplay 2026-06-01 17:35:50 +02:00
hid-redragon.c HID: redragon: fix num lock and caps lock LEDs 2018-06-25 15:23:40 +02:00
hid-retrode.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-rmi.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
hid-roccat-arvo.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-arvo.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-isku.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-isku.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-kone.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kone.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-koneplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-koneplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-konepure.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-lua.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-lua.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-pyra.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-pyra.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-ryos.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat.c HID: roccat: fix use-after-free in roccat_report_event 2026-06-01 17:35:01 +02:00
hid-saitek.c HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 18:15:34 +01:00
hid-samsung.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-semitek.c HID: semitek: new driver for GK6X series keyboards 2021-05-05 14:21:08 +02:00
hid-sensor-custom.c HID: sensor: custom: Fix use-after-free in enable_sensor 2026-08-27 14:28:23 +02:00
hid-sensor-hub.c HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads 2026-07-24 15:51:22 +02:00
hid-sjoy.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
hid-sony.c HID: sony: remove duplicate NULL check before calling usb_free_urb() 2023-10-10 21:59:08 +02:00
hid-speedlink.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-steam.c HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report 2022-09-05 10:30:06 +02:00
hid-steelseries.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-sunplus.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-thrustmaster.c HID: thrustmaster: Add sparco wheel and fix array length 2022-09-05 10:30:08 +02:00
hid-tivo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-tmff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-topseed.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-twinhan.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 178 2019-05-30 11:29:19 -07:00
hid-u2fzero.c HID: add hid_is_usb() function to make it simpler for USB detection 2021-12-14 10:57:05 +01:00
hid-uclogic-core.c HID: uclogic: Add NULL check in uclogic_input_configured() 2026-02-06 16:42:05 +01:00
hid-uclogic-params.c HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad 2022-01-27 11:03:55 +01:00
hid-uclogic-params.h HID: uclogic: Support Gray-coded rotary encoders 2019-02-21 12:00:54 +01:00
hid-uclogic-rdesc.c HID: hid-uclogic-rdesc: Kernel-doc is for functions and structs 2021-04-07 18:46:20 +02:00
hid-uclogic-rdesc.h HID: uclogic: Add support for Ugee G5 2019-02-21 12:00:54 +01:00
hid-udraw-ps3.c HID: udraw-ps3: Replace HTTP links with HTTPS ones 2020-07-20 12:24:41 +02:00
hid-viewsonic.c HID: viewsonic: Support PD1011 signature pad 2019-02-21 12:00:53 +01:00
hid-vivaldi.c HID: pass the buffer size to hid_report_raw_event 2026-06-19 13:33:31 +02:00
hid-waltop.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-core.c HID: wiimote: remove h from printk format specifier 2021-01-07 10:14:58 +01:00
hid-wiimote-debug.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-modules.c HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-wiimote.h HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-xinmo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-zpff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-zydacron.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hidraw.c HID: hidraw: fix memory leak in hidraw_release() 2022-09-05 10:30:07 +02:00
Kconfig HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
Makefile HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER 2025-04-10 14:31:58 +02:00
uhid.c HID: uhid: Use READ_ONCE()/WRITE_ONCE() for ->running 2024-04-10 16:19:42 +02:00
wacom.h HID: wacom: remove the battery when the EKR is off 2023-09-06 21:28:38 +01:00
wacom_sys.c HID: wacom: stop hardware after post-start probe failures 2026-07-24 15:51:22 +02:00
wacom_wac.c HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq 2026-04-18 10:33:29 +02:00
wacom_wac.h HID: wacom: Fix OOB write in wacom_hid_set_device_mode() 2026-06-19 13:33:28 +02:00